Daily OT Security News: August 20, 2026
Concise operational updates for OT asset owners, operators, and security teams. Each item highlights immediate implications and recommended actions grounded in the cited sources.
CISA Warns of Active Threat to Siemens S7 Series PLCs
On August 19, 2026 CISA published advisory AA26-231A describing an active campaign targeting U.S.-based Siemens S7 Series PLCs. Actors use internet scanning to find exposed or poorly protected PLCs and employ AI-generated exploitation scripts disguised as legitimate monitoring tools. CISA identifies critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities as most targeted and urges operators to inventory PLCs, apply critical patches, remove internet exposure, strengthen access controls, monitor for unauthorized activity, harden services/protocols and ladder-logic integrity, and hunt for anomalies.
Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a
NIST Releases Quick-Start Cybersecurity Guidance for Building Automation
NIST announced on August 19, 2026 a quick-start infographic offering immediate, actionable steps for resource-constrained Building Automation and Control System (BACS) owners and operators. Developed with the BACS community, the guidance is intended to provide useful protections across water and wastewater, transportation, energy, manufacturing, healthcare, and food and agriculture and underscores that OT threats and vulnerabilities can affect safe and reliable delivery of critical goods and services.
Building-OT Security Gaps Put HVAC and CCTV Assets Outside Cyber Oversight
A BankInfoSecurity report published August 19, 2026 highlights how commercial-building OT assets such as HVAC and CCTV can fall outside cybersecurity oversight when responsibility is split among engineering, IT, cybersecurity, and facilities teams. The report describes an ownership and governance gap driven by differing IT confidentiality and OT reliability priorities and recommends a dedicated joint IT-OT group reporting to the CISO with shared responsibility for vendor requirements, technology evaluation, and supply-chain decisions to restore visibility and unified oversight.
Source: https://www.bankinfosecurity.com/how-to-bridge-it-ot-divide-in-building-security-a-32433
